Malware detection method based on HTTP behavior graph

Abstract

The invention discloses a malware detection method based on an HTTP behavior graph, belonging to the technical field of network security. The malware detection method based on the HTTP behavior graphcomprises the following steps: building collected traffic into an HTTP behavior tree graph according to the collected HTTP traffic of known malicious or benign soft-wares; then extracting features ofeach node in the behavior tree graph to generate a feature tree graph; then converting the feature tree graph to a feature vector by using the Graph Embedding algorithm; then inputting the feature vector into a model for training and testing; and finally, detecting by a detection model and outputting a test result. The malware detection method based on the HTTP behavior graph solves the problem that many malware can generate legal HTTP traffic and generate a request periodically, which causes that the difficulty of distinguishing the normal software and the malware is increased and the classification effect is poor.

Description

technical field [0001] The invention belongs to the technical field of network security and relates to a malicious software detection method based on an HTTP behavior graph. Background technique [0002] Web-based services are increasingly used in Internet applications such as social networking or cloud computing. Additionally, due to the increase in network security threats, system administrators protect their networks by closing inward ports and allowing outgoing communication through selected protocols such as HTTP. Therefore, HTTP is a potential communication medium for insider security threats. [0003] When complex or new model malware generate legitimate HTTP traffic and have similar behaviors to normal software, it becomes more difficult to distinguish between normal and malicious activity by monitoring HTTP traffic, however analyzing HTTP activity is still valuable for malicious detection process. Cybercriminals or Internet spiders use web technologies as a commu...

AI Technical Summary

Problems solved by technology

[0007] The object of the present invention is to: provide the malicious software detection method based on HTTP behavior figure, solve current many malicious softwares and can produce legal HTTP flow, and regularly generate request, cause the difficulty of distinguishing normal software and malicious software to increase, classification effect is relatively poor bad question

Images